EP63 State of Autonomic Security Operations: Are There Sharks in Your SOC?

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and esteemed member of the cloud security team here at Google. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday afternoon Pacific time, please do hit that subscribe button. You can follow the show, subscribe to our tweets, and argue with us on Twitter as well, twitter.com/cloudsecpodcast. Anton, we're talking about your favorite thing in the world today, right? SOC?

Well, yes, we are. And it's going to be another one of the unusual episodes because it's actually a Panel from a conference that we are turning into a podcast, and this panel I'm going to give you a very quick preview has some celebrity guests.

Celebrity guests?

Yeah, like real world celebrities. Of course, it's audio, so you wouldn't see him, but we promise he's a real celebrity.

I heard that this person is such a celebrity; the recording actually was done from a boat.

From a boat? No way!

Is that true? Is that just a rumor?

Actually, I can confirm it, but ah, we can either confirm.

nor deny that one of these recordings was made from international waters. Listeners, with that, let's welcome today's panelists.

Hello, welcome to the panel focused on security operations. I'm Anton Chuvakin, Head of Security Solutions Strategy at Google Cloud.

Hey folks, I'm Iman Ghanizada. I am the Head of Autonomic Security Operations here at Google Cloud. I am here requesting $100 million for a 5% stake. Robert, awesome.

Well, I think, Iman, yeah, I think, Iman, if Barbara was here, she would give you that money without even thinking twice about it. Hi, everyone. I'm Robert Herjavec, and I'm the CEO of the newly formed Herjavec Group and Phish Tech and Google-based security company.

And hi, everyone. Eric Foster, president of SideArris, responsible for managed security services.

Perfect. So let's start with our substantial part. Introductions were fun, but we are here talking about how to transform security operations. So we launched Autonomic Security Operations vision a few months ago, Iman. And so the white paper and the content was kind of going viral in the industry. Tell us what's ASOAR. Explain it in brief, hopefully.

Yeah, I think the best part is I always see like the word automatic, autonomic, and autonomous. And I always see the acronyms like ASO or AOC. So it's just a lot of general confusion. Let's break it down. So, okay. So what's Autonomic Security Operations? So ASO is 2 things. Okay? So we did a lot of research thinking about what are some of the sort of evolving trends in the industry. And I think one thing that's really evident to everyone is there seems to be like a new security vendor in the market just about every day of the week. And we also have security products, right? We've got Chronicle. We now have Simplify. We have VirusTotal. We have a whole suite of offerings. Mm-hmm. And when customers sign these big, massive mega deals with Google, the one thing that the execs always ask for is, we need to modernize our security operations practice. And the answer has always historically been, go buy this product, go buy that product. And I'm sure every CISO in the world has gotten hounded down by ISVs and vendors with a new product every day in the world that claims to sort of revolutionize and transform the way that they work. But we started looking at this and we started doing some research on some of the elites, you know, Google and Netflix and all these organizations in the world. And we realized that like for the elite companies in the world that already do an incredible job managing threats, it's not so much that they have the latest groundbreaking technology in place at all points in time. It's that they approach the problem very differently. They approach this problem like it's an engineering challenge versus a traditional assembly line. And so I always say this analogy, I'm like, we've got all these Ferraris and Lamborghinis, but like people don't really know how to drive them, right? So how do we sort of take this approach to modern detection response and de-stress it from these products and turn it into like a, hey, how do we actually solve the journey of managing threats at cloud scale? Like what are the sort of core elements to sort of build out this workflow? and do modern detection and response? So I said it's 2 things. In one part, it's a framework of modern detection and response that we're building to scale and transform people, process, and technology. What I like to say is, the same way DevOps has sort of transformed the way that software development is delivered in the world, we need that same sort of ideological transformation, those practices and principles and framework to transform threat management. We need a radical alignment to how we approach this problem. so that everyone can get ahead of the modern-day threats. And then, as a solution, we take our Lamborghinis and our Ferraris, we take our Chronicle, SimpliFi, VirusTotal, our full suite of security offerings, and we partner with partners like Sidereus to help destress this story and turn it into a journey for our customers. How do we actually sit down and plan and prepare a full-scale transformation of your security operations center? From the way that your people operate today to the workflows that you adhere to, to the technologies that sort of comprise and make up of your security operations stack. So anyways, all that being said, Robert, we're really here to hear about what your thoughts are. How do we inspire a generation to reapproach this problem the same way DevOps had came and inspired all engineers to reapproach software development in a whole new light? Does this narrative hold weight? Like, what are you seeing in the market? How are you envisioning this?

Well, first of all, Iman, I think that's such an interesting perspective on it. You know, there's a Wall Street Journal article, I think a year and a half ago, that said that the average enterprise, to your point, has 62 different vendors. And here's the funny thing is, whenever I sit down with a CISO or a CEO, even better, and I say to them, how many security products do you think you have in your environment? People always say to me, gosh, 12, 13, 15, like the number— nobody is ever close to the number. So I agree wholeheartedly with the crux of the problem. I think the challenge of it, though, is you and I and all of us on this call have been doing security for a long time. And we see it as an engineering problem. All these great companies that you're talking about, the Netflixes of the world, the Googles of the world, are fundamentally at their core an engineering company. But the challenge is many of the people we're selling these technologies to are in other businesses, meaning they're in the banking business, they're in the transport business, they're in another business. And so I think it's going to take a while to transform them and bring them along because fundamentally it is an engineering problem and it is a complexity problem with data that is insurmountable at the scale that we're working today. Now, just because it's insurmountable, I don't expect the general enterprise community is just going to throw up their hands, meaning I think they're going to buy even more products. And the problem is going to come to where do people get that engineering support? If I'm not an engineering-oriented company, how do I get those smarts in my company? And that's, I think, where companies like us really fit in. And this is why I'm so bullish on managed services. And I'm not just saying that because we're in that business, but by the way, we are in that business. If anybody wants to buy managed services from us, we're happy to provide it. But all joking aside, I do think that that's one of the reasons our space is growing so quickly because inevitably there isn't enough talent. And there isn't enough people to look at the problem in the way that you've described it, Iman. So I do think 5 years from now, when we look back, everybody will agree with your entire premise of it because that's absolutely where the industry is heading.

I think it's a perfect analogy. I mean, the DevOps of threat management and security, especially as Robert just points out, DevOps was created so that you could Ultimately deliver more enterprise-class code in a faster approach with, you know, essentially that concept, move fast but have stable infrastructure behind you. And what we're talking about with ASO is bringing that same fundamental principle to the information security problem. And as Robert correctly points out, you know, it's not just a technology problem, it's a people problem, it's a process problem, and it's technology. And bringing that series and suite of best practices to the table that an organization of literally any size can adopt, whether you've got a SOC team of 50 people or you've got a security team of 3 people and you're depending on a great third-party partner like Siderys to extend your organization. You can still adopt these best practices, build that framework, align to it, but it also, to me, these kind of frameworks, the same reason DevOps is so important, Because you have to do more with less. Just like Robert said, you don't have enough people. You can't hire enough people. You can't retain enough people for this to be a problem. And even as you also pointed out, somebody who's in the, maybe the banking business is different because they've got a real strong motivation to protect those transactions and their customer information. But somebody who's in retail with very thin margins or manufacturing or something else, you know, they might not have the budget as well to be able to attract, retain that kind of talent. So they've got to make every dollar they put in play work that much harder, which, you know, is also why it breaks my heart every time we see somebody purchase a product that ultimately sits on a shelf or doesn't deliver the kind of outcomes that they actually need. And it's why we've been so both incredibly honored and incredibly just excited in the market with the relationship with Google, bringing these kind of planet-scale solutions to the table, but also doing it in a way that's more cost-effective than many of the competing approaches.

So any particular customer reactions, Eric? Anything that you've heard from people say, yeah, that works for us, it doesn't? Any customer reactions on this?

Yeah, Anton, I know you know very intimately, but we've been preaching this message, I think, in the market from the beginning. We saw the promise of Google's move into enterprise security very early and have been banging this drum a lot. And it's so fantastic to see, you know, just how viral this ASO white paper has gone as, you know, the market has really started to, I would almost say, come around to our way of seeing the world, or, you know, at least be able to put into words the fact that, you know, everybody saw the world like this, but maybe didn't have that flag in the ground to rally to. So yeah, we have several customers. Unfortunately, I can't give out some of the big names without their permission, but we've had several customers who formally adopted the Autonomic Security Operations concept and ASO and have bought into that framework. We have really been selling this solution and preaching this solution from the beginning days of Siderys. And really a whole lot of very satisfied customers who are seeing this concept of bringing to their security program the same kind of maturity, the same kind of technology, the same kind of force multiplier that are in use by Google and Facebook and Netflix, these large, largest best practices organizations.

I think what's really interesting about the points that you're making, Eric, is as I listen to it, it's such a revolutionary idea really when you think about it, not just from a product perspective, but from the people and process. Because the thing I always think about is no matter how good your castle as an enterprise is, you're always at the risk of your smallest and weakest connection. Meaning, to your point, Eric, like the large enterprise can continue this arms race of buying more, buying more, throwing more money at it, but then they're gonna have an HVAC third-party risk that isn't gonna be able to afford any of this. So if we don't change the entire spectrum of how we do security, that's always gonna be that dichotomy. Big companies, lots of money, fully protected. small HVAC supplier completely logged into their system, connected with them at every app.

Robert, that's just a ludicrous example. I mean, there's no way that there'd be like some supply chain attack on solar nugs that would affect the entire, you know, global landscape.

Yeah, I don't know where I came up with that.

You know, I have this theory. It's like, you think about the world pre-DevOps and all those, SDLC had this whole challenge of dev, QA, and prod teams that all were siloed and had this, this SDLC workflow. And when Agile came into practice and when DevOps came into practice and when SRE came into practice, most organizations were like, hey, well, we're not Google and we're not this company and we're not Facebook and we can't really adopt this style. We are not this. But it wasn't until it really became a competitive disadvantage that organizations started forcing everyone to start to adopt these philosophies. And it was the adoption of the continuous feedback loop, CI/CD, this workflow of how we deliver code effectively, quickly, securely to businesses that allowed companies, CEOs, and board members to not have to worry about their technology teams anymore when they want to enter a new market or build a new product or scale in any regard. How do we drive this elasticity in the security operations space? And so this is where, like, I was funny. I'm gonna show you, like, a little thing I mocked up on paper. I have it in a graphic now. You'll see it in the white paper. I call it the continuous detection, continuous response loop, you know, breaking this workflow from, like, the assembly line to building the actual, like, what does this look like? And we know not every organization is going to be able to be like Google and say, hey, we own pipelines end-to-end, or like Netflix, entirely SOC-less, decentralized, and everything else. We know not everyone's going to be able to adopt this, but if we can define what the aspirational vision is, every organization will then find a way to figure out how they can augment their teams, empower them to take on more responsibilities, solve problems more creatively, et cetera, et cetera, et cetera.

I'm with you. By the way, that drawing, were you hanging out with my 4-year-old twins? Because I feel sorry for them. But, you know, Iman, I think you're dead on. The challenge is this. So not to drop names, but a good friend of mine is Tony Robbins. He's a big motivational speaker. I don't know if you guys have heard of him. He's huge. He taught me something many years ago, and he said to me, pain is a much greater motivator than pleasure. And so the challenge becomes is we're talking about how to make things better. We're talking about taking a process that's fundamentally broken And adding better people, better process, better engineering to make it better. The question I have is, will the market move in that direction quickly enough because it's better, or will they wait for the pain to get so great? And I think my suggestion will be for some companies, these 62 vendors, getting breached, the pain is great. Like, what more can I do after I buy 68 technologies and I increase my budget and I still get breached? And I think we are globally coming to that tipping point where the pain is greater than simply better security. Yeah, I think we're going to get there.

And I think that it's not— I think it's a very compelling argument. And me being a bit of a fan of Tony Robbins as well, I like it. I want to argue with it because I think people want to achieve bigger things and strive for them. But you're right, ultimately, pain tends to motivate them more. And of course, there is a sliver of people who would not act even under extreme pain. They would just accept it. So, to me, the practical question here is threats will increase, or at least would change. But to me, the businesses grow much faster and much, much larger in some cases. So SOCs can't catch up. So to me, the AISO model, to a very large extent, is about growing a SOC faster than threats and assets. And people say, oh, you want to outrun the threat actor. And I'm like, no, mostly I want to outrun the business without hiring as many people. If my IT infrastructure doubles in the cloud, I'm not going to hire double the SOC. I don't have the money.

Of course.

I may buy double the products, but I may suffer as a result rather than get benefits. So how do we evolve SOCs faster than threats and businesses evolve without hiring our way to success? Because we cannot.

I think you make the exact point, Anton. And I think what we're really talking about, to me, is essentially, you know, almost a 3rd generation in security operations. The first approach to security operations was that traditional SOC-based approach. And we're going to be reactive, looking at alerts, and we're going to have a traditional 24/7 SOC that just But that scales linearly with threats. Exactly.

Threats double, you have to double. There's no other way.

Just like you're alluding to, you know, the companies and the businesses realized, one, that they couldn't prevent all of the threats and all the attacks, that they had to shift to what I would describe as the second phase, which was this realization of detection and response, that it's not classic security operations and just looking at alerts and playing whack-a-mole with blocking and keeping the bad guys out, but the understanding that we've got to be more agile. We've got to leverage a lot more technology. We've got to detect threats and threat actions, both external and internal threats, and then have a program to be able to contain and respond and ultimately, of course, egress those threats from your organization.

Yeah, that's a great point. I think to your point about linear and exponential, we can't do more. We have to do better. I think this is one of those problems that we just cannot do more. We can't hire more people. We can't throw more stuff at it. And, you know, we've been doing managed services for a really long time. And I never forget this moment almost 12 years ago, we signed up a managed service customer and my engineering team said, we need this amount of people to build the SOC. And I was like, oh my gosh, this is so exciting. Then we got a second customer And they said, we need to hire more people. And I was like, what the heck?

Yeah.

And they drew this line for me. As we got more customers, our costs would go up linearly. And I said, hang on a second. This is not a managed business. This is a consulting business. But I think one of the great things about what you guys do— see, I think there's a fundamental flaw in security today, Anton, which is We can't look at all the data. So if you accept the fact we need to do better, how can I do better if I'm not looking at all the data? How can I do better if I have a limited view because I can't get the logs because of an ingest cost? How do I ever fix a problem that linearly increases financially as the threats increase? And that's why I think the entire model—

Yeah.

Is broken. And what you guys have done is so revolutionary. We just need to get people to catch up to that revolution.

Yeah, because that's— and I guess people freak out about the threats, but funny enough, I tend to freak out more about the business changes and the speed of business change. I can almost see me writing some kind of ROI document convincing people to hire double because of doubling of the threat, but I cannot hire double if business doubles, because it's like, wait a second, no, threats are an externality, but like this stuff is, is gonna happen. So, so you're right. I mean, Robert's great point is like it's doing better in some ways where we go and SOC improves faster than a straight line. If we are in line with business and threats, we lost. If we have to grow even bigger, then we lost faster.

Right.

Yeah, I think you've got it exactly. I think this concept, we talked about the first phase being classic responsive security operations, and then a second phase being a shift to detection and response-oriented approach. And then to me, the third phase is ASO. It's realizing, okay, we've got the concept right, but we can't do it with a 1-to-1 scale of people. We have to do it with the combination of technology, and process and the people to achieve those kind of exponential outcomes with things like threat detection as code and the ability to, to Robert's point, you know, you have to be able to visualize, to ingest, to analyze and process all of the data. But then you, you can't do it by hand. You can't do it with just pure analysts sifting through 40,000 alerts a day. They've got to have the technology component that can bring and prioritize and enable them to work faster and more efficiently. And that to me is what the framework's all about.

The challenge, Anton, to your point, is exactly what you're saying, Eric, is there has to be a shift around gathering the data so that going back to the point of analyzing it better and doing better with it. But I think the market is stuck a little bit. If I can say, What you guys have done has almost been too fast and too much. It almost makes people feel skeptical. It's kind of like I'm going down the street in a horse and buggy and you come along in a car and I look at your car and I say, wow, that's a great car. That would really make me go faster. And I ask the people in my horse and buggy, do you want to get in the car? And they're like, no.

Mm-hmm.

You know, like, yeah, do I get to the same place, but I get there faster? Why do And I think that's been driven because the other market leaders in the space have conditioned the consumer at the enterprise level to feel like if they're not paying for more ingest, if they're not paying per EPS, they've disassociated and divorced more data. And now we're coming along and we're saying, we're going to do better. We're going to do better. We're going to look at all your data. And people aren't always hearing that. What they're hearing is, oh, you're going to charge me a lot more.

Charge more.

Yep. Yeah. Do you know what I mean? And I don't know if you guys see this.

Yes, very much so. It's connected in their heads. Chained.

Yes.

Chained in their heads together. Yes. Yeah.

And sometimes we need to break that chain. Now, the good news, I think, Eric, Iman, Anton, I think the market is going to do that for us. I think the sheer complexity and the sheer rise of threats is just— everybody's going to get to a point and say, I can't do it anymore. I can't do this. I can't keep paying for ingest. There has to be a better way.

What are you talking about, Robert? It's not like every company on the planet is just spending more and more on security and they're continuing to get hacked every single day. It's not like that's happening.

Well, We have to be very positive. We can't use negative analogies like FUD. We can say— actually, what can we say? It's security.

You know what I talked about earlier, right? I was like, until it became a competitive disadvantage to not be practicing DevOps and Agile and everything else, it didn't get adopted. And similarly, in the security world, until someone gets breached, that's when they're finally like, oh my God, we need to, like, invest in our security operations program, right? And so, Jenkins and Spinnaker and Ansible, These tools didn't dictate the way the world works. It was the philosophies that dictated the way the technology works. And this is why, like, adhering to like a, a CDCR model, like a continuous feedback loop model, basically will drive the market to this place where like technology vendors start to then think about how do we build the tools that map to the behaviors that we want to see humans doing, not how do we just patch human behavior and help augment analysts in the Yeah.

Because, Iman, at the end of the day, I'm the CEO of a large enterprise company. What do I really care about? Do I really care about how you're doing security, or do I care about risk? Is that really not what business we're in, is minimizing the risk in the face of escalation? And I think that's what you're talking about is, Making people more secure.

Yeah, we need to rethink this whole problem. And like, you know, the thing I always say is nowadays you go to conferences and you see everybody's got these DevOps stickers all over their laptops. It's like people are inspired. They're inspired to be doing this type of work. And we need to bring that inspiration back into the SOC. We need people to be inspired to solve security threats, not to solve cases. Right. And when we get that inspired workforce, that's going to lead to like the Web3 evolution of security operations.

Uh-oh, don't bring Bitcoin into this. This will ruin everything. So please, no.

We're going to do it on the blockchain.

I think you came this close to this, so don't.

Let me just pop up my QR code on the screen real quick.

No, I, I, I think it's such an important point that you make, that all of you are making here, because it, it really is, you know, it's about enabling the business to do what the business does. You know, they're not in the business of information security. Information security, the security department, the security team, incident response, everything else, they're there to enable the business to move faster, to achieve their revenue goals or whatever their mission is, and to do so securely. And just exactly as you've pointed out, you know, trying to do so in a world of ever-increasing threats, in a world where your budget dollar is always going to be challenged, a solution like ASO that comes to the table with a legitimate documented, fundamental, provable approach to 10x exponentially magnify your security operations in people and process and technology and really drive that efficiency. The thing that I think has resonated with some of our customers the most has been when they've sat down, looked at the ASO framework, looked at the technology that we're bringing to the table, looking at the, even the Sidereus offering entirely, but being able to look at changing their program, adopting ASO, and paying for this change in the first year, achieving that true first-year return on investment to say, yeah, we're going to go make some investment in people and in process and in technology and in this partnership. But because it's going to help us move so much faster, so much more efficiently and do what we have to do, you know, enable the business, but do so in a way that drives both better capability and that 10x factor, it's just unparalleled.

But when you adopted Chronicle, by the way, your ROI was in like 5 minutes as far as I recall, right? You got your money back in 5 minutes.

Yeah. I mean, it's—

There was some ridiculous number, right?

I remember. It literally is. I mean, it's one of those things like Robert said, it sounds too good to be true until you sit down with somebody and do the math. We had a Fortune 250 customer that their year cost of Chronicle No exaggeration, was less than 1 month of their kind of competing tool.

Well, Eric, it's such a great point. You know, my healthcare customers, our healthcare customers, our banking customers, they don't want to be in the security business. And I think what sometimes security practitioners forget is we are all in the serve business. We are there to serve our customers. I'm very clear on that. If I cannot make my customer's core business better, then I'm not doing my job. And I think that's fundamentally that we are in that service business. And to your point, there's a combination of cost, there's a combination of people, and it's just a fundamentally different way to do things. And Anton, at my age, It's nice to be at the forefront of something.

So we are close to time. So how about some closing remarks about how we are making all this come to life? Robert, you first.

I think, Anton, first of all, thanks for having me. Really enjoy conversations like this. What's exciting for me is at my age, I feel like we're just getting started. Like I've been in the security business 20, 30 years now. And I think it's really exciting. I think my final point I would say is, It's a journey. It's not an end destination. That's what I always try to say to our customers is we want to go on that journey with you. And there's, there's no magic switch. There's no light switch you're going to flip and you're going to be there tomorrow. But you've got to go down the right road. And I really feel a lot of the work that we're doing together is the right road. So thanks for having me, guys.

Eric, any comments from your side? I mean, it's the same company, I know, but still.

No, absolutely. I, you know, again, tremendously appreciate the opportunity to be here and to talk to everyone. I think from our side, what we help customers with every single day are these challenges that we're talking about. Everybody is suffering from alert fatigue. Everybody's dealing with a permanent shortage of resources and the never-ending pressure of external and even internal threats to your organization from an information security perspective. And what we're doing, what Sidereus is doing every day is helping helping our customers achieve an autonomic state of existence. We believe that in order to withstand security attacks, your modern security operation has to transform its work to become an innate defense mechanism for the organization, you know, an autoimmune system, if you will, that in the same way that DevOps provides that same capacity to your IT organization, that's what we can bring from security with this partnership with ASO and helping you and your organization achieve autonomic security operations.

Perfect. Iman, you had some fun pointers, as well.

Yeah. Yeah, no. Well, first, thank you both for being here. I had a lot of fun. I actually had a lot more fun than I thought we'd have just because I knew Foster was going to be here. So I thought he was going to give me a hard time. No, but on a more serious note, we're thrilled to obviously bring this story to the world. I always say this is a story for the people. Like, I want to build this in the industry with everyone because the same way DevOps, again, it's something that everyone can adhere to. We need an approach, we need an ideology that people can adhere to and really figure out how to make it their own, right? So, we're doing a lot of research in this space. We just announced our partnership with the MITRE Center for Threat-Informed Defense, where we're doing a lot of joint R&D initiatives on really improving the state of research and capabilities for threat-informed defenses. We just launched our public sector ASO solution to meet the requirements of the latest White House executive order, particularly the components of cybersecurity analytics. And the OMB had released a memorandum, M-21-31. Our solution is built to address all of those requirements with the full ASO stack. And again, 2 of the core elements of that EO was not incremental change, like transformational change. An investment in people, an investment in technology. And that's what we're trying to do here. Cyderis, one of our core launch partners in bringing that into the federal space. And lastly, we have an initiative we just launched called Threat Detections as Code, where we're starting to build a community around collaborating on building analytics, right? You know, I've got this thesis that at some point analytics are going to start to get standardized as cloud and infrastructure as code and policy as code and all these things drive to normalization and to a set of standards. We're going to get to a place in the industry sometime many years from now where analytics are going to start to get standardized. And we do that by collaborating in the industry. And so we just launched this initiative to bring Chronicle analytics to all of the defenders who are using the tool today. And you're going to see it expand on to have dashboards, playbooks, all sorts of other things. So really interested in fostering the community around collaborating there. Sidereus, obviously one of our great great partners to help bring this to light. And with that, yeah, thanks everyone for being here.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton underscore Chuvakin and underscore Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode. Security.